The short answer
Website penetration testing is an authorised, manual attack on your public website: its content management system, plugins or apps, admin login, forms, customer accounts, checkout journey and the server or platform it runs on. Unlike an online scan, a tester confirms which weaknesses can really be exploited, tests logged-in areas and gives a specific fix for each finding.
On this page
- What does website penetration testing cover?
- What are the common risks on WordPress, Shopify and Magento sites?
- Can an online scanner pen test my website?
- Website or web application penetration testing: which do you need?
- What drives the cost of a website penetration test?
- How does a website penetration test work?
- What does a website pen test report look like?
- Why Sovereign Secure for website penetration testing?
- Get a fixed quote for your website penetration test
Website penetration testing is a manual, authorised test of the website your customers use: the content management system (CMS), its plugins or apps, the admin login, contact and checkout forms, customer accounts and the hosting underneath. A tester works the way an attacker would, proves which weaknesses can actually be exploited and tells you how to fix each one.
This page is for brochure sites and online shops built on WordPress, WooCommerce, Shopify or Magento. If you run a custom-built platform, portal or SaaS product with many user roles and complex workflows, you need web application penetration testing, which is scoped for that depth. New to testing altogether? Our guide to what penetration testing is covers the basics.
What does website penetration testing cover?
Everything a visitor, customer or attacker can reach through your site, within the scope you authorise:
| Area | What we test | Weaknesses we look for |
|---|---|---|
| CMS core | Version, configuration, default files | Outdated core with published vulnerabilities, setup or install files left behind |
| Plugins, extensions, themes and apps | Every installed component, plus any custom code | Vulnerable or abandoned plugins, insecure custom code, unofficial “nulled” themes |
| Admin login and accounts | The admin URL, staff accounts and roles | No MFA, weak or reused passwords, username enumeration, too many administrators |
| Forms, search and uploads | Contact, quote, review and file upload forms | Cross-site scripting, injection, unrestricted file upload, forms abused to send spam |
| Customer accounts | Registration, login, password reset, order history | Account takeover, one customer viewing another’s orders or addresses |
| Basket and checkout journey | Prices, quantities, discount codes, delivery options | Price or discount manipulation, skipping steps in the checkout flow |
| Hosting and server, where you control it | Web server, control panel, SSH or FTP, database ports, TLS | Exposed control panels, outdated PHP, directory listing, backups in the web root |
| Third-party scripts and integrations | Analytics, chat, marketing, CRM and stock integrations | Scripts loaded from untrusted sources, API keys exposed in page code |
Testing follows the OWASP Web Security Testing Guide and covers the risks in the OWASP Top 10, adapted to how CMS-based sites are actually attacked.
If customers pay on your site, or your site redirects to or embeds a payment provider’s page, check PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1 on payment page scripts, which have applied since 31 March 2025 to merchants whose SAQ includes them; our guides to PCI DSS for e-commerce businesses and SAQ A vs SAQ A-EP explain whether they apply to your checkout.
What are the common risks on WordPress, Shopify and Magento sites?
Each platform has a different attack surface because you control a different amount of it. A self-hosted WordPress or Magento site puts the whole stack in your hands; a hosted platform like Shopify leaves you responsible for accounts, apps and custom code.
| Platform | What you control, and we test | Common weaknesses |
|---|---|---|
| WordPress and WooCommerce (self-hosted) | Core, plugins, themes, server and database | Vulnerable plugins, user enumeration, xmlrpc.php password attacks, dashboard file editor left on, exposed configuration backups or debug logs |
| Shopify | Staff accounts, apps, theme code, custom apps and integrations, DNS | Staff accounts without two-step authentication, apps with broad permissions, secrets in theme files, insecure custom app back ends |
| Magento Open Source and Adobe Commerce | Core, extensions, server, admin and APIs | Missing security patches, a guessable admin path, vulnerable extensions, over-exposed REST or GraphQL endpoints |
WordPress and WooCommerce
Plugins are the usual weak point. Each one adds code to your site, and plugins that are no longer maintained stop receiving security fixes. We list every plugin and theme, check versions against published vulnerabilities, then test the ones that matter by hand, including custom code that no scanner will recognise. We also check how easily usernames can be discovered through author pages and the REST API, whether xmlrpc.php lets an attacker try many passwords in one request, and whether the dashboard file editor would let a stolen admin account change site code.
Shopify
Shopify runs the platform, the hosting and the checkout, so a test of your store does not attack Shopify’s own infrastructure. It focuses on what you control: who has staff access and whether they use two-step authentication, which apps are installed and what data they can read, any secrets left in theme files, and any custom app or integration you host yourself. We confirm what the platform’s terms allow during scoping.
Magento and Adobe Commerce
Self-hosted Magento puts patching on you. Adobe publishes security patches for Magento Open Source and Adobe Commerce, and a site that falls behind is exposed to flaws that are already public. Magento 1 reached end of life in June 2020 and no longer receives security patches, so if you still run it the fix is migration, not a test. Magento checkouts have long been a target for card-skimming code injected through compromised extensions or admin accounts; our guide to Magento PCI compliance covers the payment side in detail.
Can an online scanner pen test my website?
No. Search for a pen test online and most of what you find are automated scanners, sold as online penetration testing, that check for known patterns. They are worth using between tests, but they cannot do what a tester does during a website pentest: log in, follow your checkout, try to see another customer’s order or prove that a flaw can be exploited.
| Check | Online scanner | Website penetration test |
|---|---|---|
| Outdated CMS, plugin and server versions | Yes | Yes, and confirms which are exploitable |
| TLS settings, security headers, open ports | Yes | Yes |
| Logged-in areas, customer accounts and admin | Limited | Yes, with each account type |
| Business logic, such as discount abuse or viewing other orders | No | Yes |
| False positives removed | No | Yes |
| Low-risk issues chained into a real attack | No | Yes |
| Fixes your developer can act on | Generic advice | Specific to your site and platform |
Free online scanners and open-source tools are a sensible first check on a site you own. Only scan sites you own or have written permission to test. For regular automated checks between penetration tests, see our vulnerability scanning service.
Website or web application penetration testing: which do you need?
Choose by how the site is built and how many kinds of user it has, not by its size.
| Aspect | Website penetration test | Web application penetration test |
|---|---|---|
| Typical target | Brochure site or shop on WordPress, WooCommerce, Shopify or Magento | Custom-built portal, platform or SaaS product |
| User types | Visitors, customers and a few admin roles | Many roles, tenants or permission levels |
| Main risks | Plugins, admin access, checkout, hosting | Access control, business logic, APIs |
| Depth of logic testing | Checkout and account journeys | Every workflow, role and permission |
For a small business deciding where a website test fits alongside email, remote access and the office network, see penetration testing for small businesses.
What drives the cost of a website penetration test?
Scope drives cost, because most website pen testing is priced by tester-days. These are the factors that change the number of days a website test needs:
| Cost driver | Why it changes the effort |
|---|---|
| Hosted or self-hosted platform | Self-hosted sites add the server, database and control panel to the scope |
| Number of plugins, extensions or apps | Each one is checked, and custom ones are tested by hand |
| Custom code | Bespoke themes, plugins and integrations need manual testing |
| Customer accounts | Logged-in journeys and access between accounts add test cases |
| Checkout complexity | Discounts, subscriptions, trade pricing and multiple currencies each add logic to test |
| Number of sites or store views | Each extra domain or storefront adds scope |
| Staging or production | A staging copy allows faster testing with fewer restrictions |
| Retest | The number of findings to verify after you fix them |
Our penetration testing cost guide sets out published UK price ranges by test type. Sovereign Secure quotes a fixed price once the scope is agreed.
How does a website penetration test work?
- Scoping. You send the site address, platform, list of plugins or apps, hosting provider and the account types we should test with. We agree a testing window and send a fixed-price proposal.
- Authorisation. You sign written authorisation. If an agency, developer or hosting company manages the site, we bring them in now, because some hosts need notice before testing.
- Testing. Manual testing backed by professional tooling, on staging or on the live site at an agreed time. Anything critical is reported the day we confirm it, so you can act before the report arrives.
- Report and debrief. A plain-English summary for the business owner and technical findings with evidence, severity ratings and fixes your developer or agency can apply, followed by a walkthrough call.
- Retest. Once fixes are live, we retest them and reissue the report showing which findings are closed.
Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
What does a website pen test report look like?
Each finding in a website pentest report is written so your developer or agency can fix it without a meeting. Here is an illustrative finding, not taken from a client report, laid out field by field:
| Field | Example |
|---|---|
| Title | Customers can view other customers’ orders |
| Severity | High |
| Affected area | Order history page in the customer account area |
| What was found | Changing the order number in the order page’s web address showed another customer’s name, address and order details. Order numbers run in sequence, so every order could be read in turn. |
| Evidence | The requests made from two test accounts, with screenshots of the result |
| Impact | Any registered customer could read every other customer’s personal data, a personal data breach you may have to report to the ICO |
| Fix | Check on the server that the signed-in customer owns the order before showing it, and return a generic error if not |
| Retest result | Closed once the same request from the second account returns an error |
Around the findings, the report gives a plain-English summary for the business owner, the scope and dates tested, the methodology and a severity rating for every issue. Our guide to reading a penetration test report explains how to turn the findings into an action plan.
Why Sovereign Secure for website penetration testing?
- A PCI SSC Qualified Security Assessor company. We know how PCI DSS applies to e-commerce checkouts, so findings on your payment journey are reported with the right context.
- Web testing in depth when you need it. We also carry out web application, API and source code review testing, so a site that outgrows a website test can move to a deeper scope without changing provider.
- An IASME-licensed Cyber Essentials certification body, which helps if a customer has asked for Cyber Essentials as well as a test.
- ISO 27001 certified. Your site details, credentials and findings are handled under an independently certified information security management system.
- UK headquartered in Accrington, Lancashire, testing remotely wherever your site is hosted.
Get a fixed quote for your website penetration test
Send us your site address, platform, plugin or app list, hosting provider and the reason for the test, and we will confirm the scope and send a fixed price. Use the penetration testing quote form or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
